Aircraft flight control surfaces, such as ailerons, elevators and rudders, are usually operated by hydraulic actuators, generally consisting of a hydraulic cylinder enclosing a piston mounted on an actuator rod. The hydraulic fluid applied to the hydraulic actuator is generally controlled by an electrohydraulic servovalve having at least one control coil receiving a control signal from a controller. In order to verify the correct operation of the actuator, a linear variable differential transformer may be coupled to the actuator rod. The linear variable differential transformer provides a feedback signal to the controller which indicates the position of the actuating rod. In a similar vein, a linear variable differential transformer may be mechanically coupled to the electrohydraulic servovalve stem to provide a monitor signal to the controller which indicates the position of the valve stem and hence the rate of actuator movement.
The safe operation of aircraft employing hydraulic control systems obviously depends upon the proper operation of the system. Furthermore, the high speed at which aircraft travel can prevent the detection of a flight control malfunction before the aircraft crashes, with attendant loss of life and property. It is thus necessary for hydraulic flight control system to be built as "fail safe" as possible or else be able to operate effectively in the event of a failure, that is, it must be fail operational.
The typical approach to implementing a "fail safe" flight control system is to use redundant components in the system. A flight control system utilizing redundant components can continue to function after the malfunction of a single component. To further improve the reliability of redundant flight control systems, the number of redundant components can be increased to even more than two or even three identical components.
Theoretically, the reliability of a flight control system can reach any desired value by merely increasing the number of redundant components. However, in practice, the number of redundant components that can be used in limited by several factors. First, it is normally desirable to minimize the weight of aircraft employing flight control systems. The extra weight resulting from the use of redundant components unduly increases the weight of aircraft. Second, a greater number of redundant components increases the probability that at least one of the components will fail, thus producing an unacceptable mean time between failure for the entire system. Finally, the use of redundant components can easily multiply by several times the cost of the flight control systems. Therefore, it is important that optimum redundancy be achieved with a minimum number of components.
In the past, attempts have been made to combine dual-coil electrohydraulic servovalves with one or two digital controllers. However, the use of a single, dual-coil electrohydraulic servovalve, when controlled by either single or dual controllers, cannot satisfy the safety/reliability requirements. Moreover, the use of a dual-coil electrohydraulic servovalve and dual controllers can result in operating ambiguities in the event of a malfunction since it may not be possible to determine which controller and/or electrohydraulic servovalve coil has malfunctioned.